WScript Launching rust-setup-launch.vbs to Execute rust-setup.ps1

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•1

Detects a suspicious execution chain where wscript.exe is used to run a file named 'rust-setup-launch.vbs' from a temporary directory, which subsequently triggers powershell.exe to execute a script named 'rust-setup.ps1'. This behavior is indicative of a staged supply chain attack.